CVE-2026-14457 OpenSSL CVE debrief

Who should care

Defenders and administrators of systems using OpenSSL for cryptographic operations, especially those using RPKs without a certificate, should assess their exposure and prioritize upgrading to patched versions to prevent potential DoS attacks.

Why it matters

CVE-2026-14457 is a NULL pointer dereference vulnerability in OpenSSL that can lead to a Denial of Service (DoS). It affects systems using RFC7250 Raw Public Keys (RPKs) without a corresponding certificate. Defenders should prioritize upgrading to patched versions to prevent potential DoS attacks.

• Potential Denial of Service (DoS) due to application abort
• Verification of RPK configurations and certificate presence required
• Upgrade to patched OpenSSL versions necessary for mitigation

Technical summary

The vulnerability exists in OpenSSL when using RFC7250 Raw Public Keys (RPKs) without a corresponding certificate. A NULL pointer dereference occurs when a remote peer solicits raw public keys and sends the 'signature_algorithms_cert' TLS extension, potentially leading to a Denial of Service (DoS) due to an application abort. This issue affects OpenSSL versions 3.4.0 to 3.4.7, 3.5.0 to 3.5.8, 3.6.0 to 3.6.4, and 4.0.0 to 4.0.2. Defenders should prioritize upgrading to patched versions to prevent potential DoS attacks. Systems using RPKs without a certificate are at higher risk and should be updated immediately.

Defensive priority

Defenders should prioritize upgrading to patched versions of OpenSSL, specifically 3.4.8, 3.5.9, 3.6.5, or 4.0.3, to prevent potential DoS attacks. Systems using RPKs without a certificate are at higher risk and should be updated immediately.

Recommended defensive actions

• Upgrade to OpenSSL version 3.4.8, 3.5.9, 3.6.5, or 4.0.3 or later
• Configure a corresponding certificate for RPKs
• Review and update affected systems and applications
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a NULL pointer dereference when a remote peer solicits raw public keys and sends the 'signature_algorithms_cert' TLS extension. The issue is limited to configurations with RPKs enabled and no associated certificate. The impact is restricted to a possible Denial of Service due to an application abort.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.